Triggerless Backdoor Attack for NLP Tasks with Clean Labels

Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 2942 - 2952 July 10-15, 2022 ©2022 Association for Computational Linguistics Triggerless Backdoor Attack for NLP Tasks with Clean Labels Leilei Gan1, Jiwei Li1,2, Tianwei Zhang3, Xiaoya Li2 Yuxian Meng2, Fei Wu1,4, Yi Yang1, Shangwei Guo5, Chun Fan6 1Zhejiang University, 2Shannon.AI, 3Nanyang Technological University 4Shanghai Institute for Advanced Study of Zhejiang University, 4Shanghai AI Laboratory 5Chongqing University, 6Peng Cheng Laboratory, 6 Computer Center, Peking University 6National Biomedical Imaging Center, Peking University {leileigan, wufei, yangyics}@zju.edu.cn, jiwei_li@shannonai.com Abstract Backdoor attacks pose a new threat to NLP models. A standard strategy to construct poi- soned data in backdoor attacks is to insert trig- gers (e.g., rare words) into selected sentences and alter the original label to a target label. This strategy comes with a severe flaw of being easily detected from both the trigger and the label perspectives: the trigger injected, which is usually a rare word, leads to an abnormal nat- ural language expression, and thus can be eas- ily detected by a defense model; the changed target label leads the example to be mistakenly labeled, and thus can be easily detected by man- ual inspections. To deal with this issue, in this paper, we propose a new strategy to perform textual backdoor attack which does not require an external trigger and the poisoned samples are correctly labeled. The core idea of the pro- posed strategy is to construct clean-labeled ex- amples, whose labels are correct but can lead to test label changes when fused with the train- ing set. To generate poisoned clean-labeled examples, we propose a sentence generation model based on the genetic algorithm to cater to the non-differentiable characteristic of text data. Extensive experiments demonstrate that the proposed attacking strategy is not only ef- fective, but more importantly, hard to defend due to its triggerless and clean-labeled nature. Our work marks the first step towards develop- ing triggerless attacking strategies in NLP1. 1 Introduction Recent years have witnessed significant improve- ments introduced by neural natural language pro- cessing (NLP) models (Kim, 2014; Yang et al., 2016; Devlin et al., 2019). Unfortunately, due to the fragility (Alzantot et al., 2018; Ebrahimi et al., 2018; Ren et al., 2019; Li et al., 2020; Zang et al., 2020; Garg and Ramakrishnan, 2020) and lack of interpretability (Li et al., 2016a; Jain and Wallace, 1https://github.com/leileigan/clean_ label_textual_backdoor_attack 2019; Clark et al., 2019; Sun et al., 2021) of NLP models, recent researches have found that back- door attacks can be easily performed against NLP models: an attacker can manipulate an NLP model, generating normal outputs when the inputs are nor- mal, but malicious outputs when the inputs are with backdoor triggers. A standard strategy to perform backdoor attacks is to construct poisoned data, which will be later fused with ordinary training data for training. Poi- soned data is constructed in a way that an ordinary input is manipulated with backdoor trigger(s), and its corresponding output …

Content truncated to 500 words